Table of Contents
- Introduction
- iOS 27 and iPadOS 27: ~126 Fixes
- macOS Golden Gate 27: 210 Vulnerabilities
- macOS Tahoe 26.7: 153 Unique CVEs
- ~100 Flaws Shared Across Mobile and Desktop
- The Standout CVE: CoreMedia Memory Corruption
- Other Releases: iOS 26.7, macOS Sequoia 15.8, and More
- Not Exploited in the Wild — Yet
- The Enterprise Patching Gap: From Constraint to Choice
- What Businesses Should Do
- Final Thoughts
Introduction
Apple on Monday announced patches for a record number of vulnerabilities across its desktop and mobile operating systems, including more than 200 flaws patched with the latest major releases: iOS 27 and macOS Golden Gate 27.
The updates resolve kernel vulnerabilities that could lead to memory corruption, privilege escalation, system termination, and information leaks.
This blog is based on reporting by Ionut Arghire, SecurityWeek (September 15, 2026). Apple makes no mention of any of these defects being exploited in the wild.
iOS 27 and iPadOS 27: ~126 Fixes
iOS 27 and iPadOS 27 include fixes for about 126 security flaws, 20 of which affect the kernel.
Kernel-level vulnerabilities are particularly serious because the kernel sits at the core of the operating system. A flaw there can be used to:
- Corrupt memory — Destabilizing the system or enabling code execution
- Escalate privileges — Gaining higher-level access than intended
- Terminate the system — Causing crashes or denial of service
- Leak information — Exposing sensitive data to unauthorized parties
Kernel flaws are among the most valuable to attackers because they can bypass many layers of security. Apple fixing 20 kernel issues in one release is significant.
macOS Golden Gate 27: 210 Vulnerabilities
macOS Golden Gate 27 addresses 210 vulnerabilities, roughly 100 of which are shared with the iOS 27 release.
This is the largest single-release patch count in Apple's history, and it reflects both the growing complexity of macOS and the increasing scrutiny the platform receives from security researchers.
| Release | Vulnerabilities Patched | Kernel Flaws |
|---|---|---|
| iOS 27 / iPadOS 27 | ~126 | 20 |
| macOS Golden Gate 27 | 210 | ~100 shared with iOS 27 |
| macOS Tahoe 26.7 | 153 unique CVEs | 26 |
| iOS 26.7 / iPadOS 26.7 | 80+ | — |
| macOS Sequoia 15.8 | 150+ | — |
macOS Tahoe 26.7: 153 Unique CVEs
macOS Tahoe 26.7 patches 153 unique CVEs, including 26 security defects in the kernel that could lead to memory corruption, privilege escalation, system termination, and information leaks.
While the vast majority of the issues were discovered in 2026, the macOS update also fixes CVE-2022-3437, a medium-severity heap-based buffer overflow in Samba (within Heimdal) that could lead to denial-of-service (DoS) attacks.
CVE-2022-3437 is a four-year-old vulnerability. Its inclusion in this release shows that even long-known flaws can remain unpatched for years — and that attackers may still be able to exploit them.
~100 Flaws Shared Across Mobile and Desktop
Approximately 100 of the resolved security defects affect both the mobile and desktop operating systems. The fixes target more than 90 platform components, including:
- AppleKeyStore — Cryptographic key storage
- Authentication Services — Login and identity verification
- Foundation — Core system framework
- Safe Browsing — Web threat protection
- Sandbox — App isolation
- Security — Security framework
- TCC — Transparency, Consent, and Control (privacy permissions)
- WebKit — Safari's rendering engine
The breadth of affected components — from key storage to privacy controls to the browser engine — means these patches touch nearly every part of the user experience. Prioritize updating.
The Standout CVE: CoreMedia Memory Corruption
According to Jamf senior enterprise strategy manager Adam Boynton, one of the iOS bugs that stands out is CVE-2026-64752, a memory corruption issue in the media processing framework CoreMedia.
"An attacker could compromise an iPhone by getting a malicious image in front of the user. Interestingly, rather than patching the flawed code, Apple chose to remove it entirely."
— Adam Boynton, JamfThis is a notable approach: instead of fixing the vulnerable code, Apple deleted it entirely. That's often a stronger remediation, because it removes the attack surface rather than trying to secure it.
CVE-2026-64752 is a zero-click risk — the attacker only needs the victim to view a malicious image. This makes it especially dangerous for high-value targets.
Other Releases: iOS 26.7, macOS Sequoia 15.8, and More
On Monday, Apple also rolled out:
- iOS 26.7 and iPadOS 26.7 — Patches for over 80 vulnerabilities (including approximately 70 resolved in iOS 27 and iPadOS 27)
- macOS Sequoia 15.8 — Over 150 patches (more than 140 also found in macOS Tahoe 26.7)
- tvOS 27, watchOS 27, and visionOS 27 — Patches for dozens of security flaws each
- Safari 27 — Six fixes
- Xcode 27 — One patch
This is a comprehensive, ecosystem-wide security release. If you manage Apple devices in an enterprise, plan to update across iOS, iPadOS, macOS, tvOS, watchOS, visionOS, and Safari.
Not Exploited in the Wild — Yet
Apple makes no mention of any of these security defects being exploited in the wild. Users are advised to update their devices as soon as possible.
"Not exploited in the wild" does not mean "safe to delay." Once patches are released, attackers often reverse-engineer them to develop exploits for unpatched devices. The window between patch release and exploitation is shrinking.
Additional information is available on Apple's security releases page.
The Enterprise Patching Gap: From Constraint to Choice
Boynton of Jamf framed the enterprise challenge clearly:
"The number of fixes in iOS 27 matters less than where they sit, and this is a kernel release rather than a browser release. For enterprises, the question is the same every September: how long does it take a fix Apple shipped on day one to reach every device that touches corporate data? That gap used to be a constraint and is now a choice, because same-day support means an estate can be current in hours rather than weeks."
— Adam Boynton, JamfThis is the key operational insight for IT teams. The question isn't whether Apple patched fast — it's whether your organization can deploy those patches fast enough.
With modern device management (MDM), zero-touch deployment, and same-day support, enterprises can now patch in hours rather than weeks. The bottleneck is no longer technology — it's process and policy.
What Businesses Should Do
If your organization manages Apple devices, here's a practical checklist:
- Prioritize iOS 27 and macOS Golden Gate 27 — These contain the largest and most critical fixes
- Update iOS 26.7 and macOS Sequoia 15.8 — If you can't move to the latest major release yet
- Patch tvOS, watchOS, visionOS, and Safari 27 — Don't forget the edge devices
- Focus on kernel fixes first — 20 kernel flaws in iOS, 26 in macOS Tahoe
- Review CoreMedia exposure — CVE-2026-64752 is a zero-click image-based risk
- Use MDM to push updates — Same-day support is now achievable with modern tooling
- Verify patch coverage — Ensure every device touching corporate data is updated
- Track CVE-2022-3437 — Even old vulnerabilities can resurface if unpatched
- Document your patching SLA — How many hours from Apple release to fleet-wide deployment?
- Plan for the next release — September is Apple's biggest patch month; build a repeatable process
If your organization needs help with Apple device management, patch deployment, or MDM configuration, consider working with a managed IT partner.
Final Thoughts
Apple's September 2026 release is the company's largest security update ever — over 200 vulnerabilities patched across iOS 27 and macOS Golden Gate 27, with kernel flaws at the center. The fixes span more than 90 platform components, from key storage to the browser engine.
Key takeaways:
- Record patch count — 200+ flaws across iOS 27 and macOS Golden Gate 27
- Kernel flaws are the priority — 20 in iOS 27, 26 in macOS Tahoe 26.7
- ~100 flaws shared — Mobile and desktop overlap means coordinated patching matters
- 90+ components affected — Including AppleKeyStore, TCC, Sandbox, and WebKit
- Standout CVE — CVE-2026-64752 (CoreMedia) removed entirely, not patched
- Old flaw included — CVE-2022-3437 (Samba/Heimdal) from 2022
- No in-the-wild exploitation — But patch fast; the window is shrinking
- Enterprise gap is now a choice — Same-day support means hours, not weeks
- Don't forget the ecosystem — tvOS, watchOS, visionOS, Safari 27, and Xcode 27
If your organization needs help patching Apple devices at scale, implementing MDM, or building a repeatable monthly patch process, contact SystemLogicIT for expert guidance across the United States and United Kingdom.